Subject: Kerberos User to User Authentication

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 23 Aug 1999 09:02:13 -0500

RFC 1510 calls for the user-to-user authentication. Is this implemented 
in any version of Kerberos: MIT, DCE or Microsoft? And is it usable via 
the GSSAPI? 

I see that the MIT 1.0.6 KDC appears to support this, but what about 
the client and server side, and the GSSAPI? 

I have a copy of:
   <draft-ietf-cat-user2user-02.txt > 
   "User to User Kerberos Authentication using GSS-API", 
   October 31,1997,
   Michael M. Swift.
What ever became of this? 

In particular, I want to be able to have:

  user process UA delegates to Server B which starts user process UB. 
  user process UA delegates to Server C which starts user process UC. 

  Processes UB and UC can then use GSSAPI to authenticate between them. 
  without Server B or C being involved. 

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Ken Hornstein <[email-masked]>
Date: Mon, 23 Aug 1999 10:41:53 -0400

>in any version of Kerberos: MIT, DCE or Microsoft? And is it usable via 

In order: Yes, I don't know, probably, no.

>the client and server side, and the GSSAPI? 

There are the example U2U programs included with the MIT distribution;
they work, and I've written some code of my own as well.

>What ever became of this? 

Well, it's obviously expired now.  Microsoft may implement this; I
don't think anyone else does.

--Ken

---

From: "S. Nielsen" <[email-masked]>
Date: Tue, 24 Aug 1999 09:37:39 +0000

> In order: Yes, I don't know, probably, no.

Microsoft has implemented Kerberos exactly as described in RFC 1510

-- S. Nielsen